De-package graphrag and move to the openai v3 SDK

graphrag -> graphrag-llm -> litellm pins openai<3 (and litellm has not
lifted it in any release), which capped the whole lockfile, and the
GraphRAG-vs-RAG experiment (F28) is concluded. Reproducing it is now a
manual side install documented in evals/graphrag.md; contributing.md
describes that pattern for conflicting eval-only dependencies.

With both pins gone the project floors openai>=3. Nothing imports the SDK
directly (langchain-openai 1.5.0 supports 2.x and 3.x), and v3's only
breaking change is the httpx2 HTTP layer with OS trust-store verification,
which the python:3.13 image satisfies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

evals/contributing.md

@@ -117,7 +117,7 @@ The findings log is **"what did we learn"** — durable lessons about managing t
 
 ## 6. Dependencies
 
-If your experiment adds a dependency production doesn't need (e.g. a retriever you concluded not to adopt), put it in `[project.optional-dependencies]` and guard its tests with `pytest.importorskip`, so the prod image (`uv sync --locked`) stays lean. Example: the `graphrag` extra — reproduce with `uv sync --extra graphrag`.
+If your experiment adds a dependency production doesn't need (e.g. a retriever you concluded not to adopt), keep it out of `pyproject.toml`: document a manual `uv pip install ...` in the experiment's doc and guard its tests with `pytest.importorskip`, so the prod image (`uv sync --locked`) stays lean and the shared lockfile never inherits the experiment's version pins. Example: graphrag (whose litellm pins `openai<3`) — see the Setup section of `evals/graphrag.md`.
 
 ## 7. Merge back
 

evals/graphrag.md

@@ -51,19 +51,25 @@ question). Both arms run on those 41 cases, both restricted to that source
 Measured course-content indexing rate: **~$88 / 1M corpus tokens** (vs ~$255 for
 dense API-reference docs). full_stack = 486k tokens -> **~$43** to index.
 
-## Setup (optional extra)
+## Setup (manual install)
 
-`graphrag` (and its `lancedb`/`litellm`/`pandas` deps) is an **eval-only optional
-extra** — it is imported lazily and only by the opt-in `graphrag` retriever, never
-on the production path, so it is kept out of the default install to keep the prod
-image lean. Install it to build/run this experiment:
+`graphrag` (and its `lancedb`/`litellm`/`pandas` deps) is deliberately **not in
+`pyproject.toml`**: its litellm dependency pins `openai<3`, which would cap the
+whole project's openai SDK, and the experiment is concluded (F28) so it does not
+justify permanent packaging. It is imported lazily and only by the opt-in
+`graphrag` retriever, never on the production path. To build/run this
+experiment, install it into your synced venv on the side:
 
 ```bash
-uv sync --extra graphrag
+uv pip install "graphrag>=3.1.0"
 ```
 
-A default `uv sync` (prod, CI) omits it; `tests/test_graph_rag.py` skips itself
-when the extra is absent.
+Two consequences of the manual install: it downgrades `openai` to 2.x inside
+your venv while graphrag is present (fine for the experiment; langchain-openai
+supports both), and any later `uv sync` prunes graphrag and restores openai v3
+(re-run the install command if you need it again). A default `uv sync` (prod,
+CI) never includes it; `tests/test_graph_rag.py` skips itself when graphrag is
+absent.
 
 ## Build the graph DB
 

pyproject.toml

@@ -19,7 +19,9 @@ dependencies = [
     "langchain-openai",
     "nbconvert",
     "nbformat",
-    "openai",
+    # Not imported directly (langchain-openai is the consumer, and it supports
+    # 2.x and 3.x); the floor documents that this repo expects the v3 SDK.
+    "openai>=3",
     "pydantic",
     "python-dotenv",
     "requests",
@@ -27,13 +29,6 @@ dependencies = [
     "uvicorn",
 ]
 
-[project.optional-dependencies]
-# Eval-only: the GraphRAG-vs-RAG experiment (F28). Pulls graphrag + lancedb/litellm/
-# pandas, all imported lazily and only by the opt-in `graphrag` retriever — never on
-# the production path. Kept out of the default install so the Spaces image stays lean.
-# Reproduce the experiment with: uv sync --extra graphrag  (see evals/graphrag.md).
-graphrag = ["graphrag>=3.1.0"]
-
 [dependency-groups]
 dev = [
     "httpx",